SmugMug API: What Photographers Can Actually Automate
The gallery is ready; the client communication should be too. Carly can send the delivery note, follow up with someone who has not opened it, answer an inquiry, and keep print-order communication moving. SmugMug holds the photos and galleries; Carly runs the client work around them and can check uploads or prepare a business brief on a schedule.
Any current SmugMug subscriber can get an API key in about a minute, on any plan. The docs say it plainly: “Access to the SmugMug API is available to all current SmugMug subscribers.” No Pro or Portfolio requirement, no approval queue. The only gate is paying for SmugMug at all.
Two things about it will shape whatever you’re planning, so they’re worth knowing before you start: it’s OAuth 1.0a, and there are no webhooks.
What photographers actually automate with it
SmugMug never tells you when something happens, so the useful trick is to stop waiting on SmugMug.
Your inbox already knows. SmugMug emails you on orders and gallery activity, and acting on that email is both faster and simpler than checking the API on a timer:
- Order confirmations and print follow-up — thanking the client, confirming the timeline, prompting the reorder.
- Gallery delivery sequences — the “your gallery is ready” note, the nudge a week later to the client who hasn’t opened it, the reminder before the download link expires.
- Client enquiries that arrive by email long before they touch SmugMug at all.
Checking on a schedule covers the rest — new galleries, upload batches, and anything you want summarised weekly.
Worth being clear about what isn’t achievable: there’s no way to have something happen the instant a client views or orders from a gallery, because SmugMug offers no mechanism for it. Anything promising otherwise is either polling frequently or reading your email — and reading your email is the better version.
Getting a key
Log into SmugMug, then visit https://api.smugmug.com/api/developer/apply and accept the API terms. The key is issued immediately. SmugMug asks that “each individual application or use of the API should use its own key,” and you manage existing ones through “Manage Applications” in the docs toolbar.
OAuth 1.0a, and nothing newer
SmugMug’s authorization docs state it outright: “SmugMug currently supports OAuth 1.0a.” Signatures are HMAC-SHA1 or PLAINTEXT over HTTPS. There is no OAuth 2.0, no personal access token, and no bearer-token path anywhere in the documentation.
This matters practically. Most modern HTTP and auth stacks dropped first-class OAuth 1.0a support years ago, so expect to pull in a legacy signing library or hand-roll the signature. Access tokens, at least, never expire unless the user revokes them.
There’s a lighter path for public data only: append APIKey=your-key to the query string and skip authorization entirely. That works for anything publicly visible and nothing else.
The endpoints:
- Base URL
https://api.smugmug.com/api/v2 - Uploads go somewhere else entirely —
https://upload.smugmug.com/ - v2 is the only version. 1.3.0 and earlier were deprecated and removed in 2025.
Rate limits exist but the numbers don’t
SmugMug documents the mechanism — windowed limits, per-user-per-application when authenticated, per-application when not — with X-RateLimit-Remaining and X-RateLimit-Reset headers and a 429 plus Retry-After when you exceed them.
It publishes no actual figures. Not in the docs, not anywhere findable, and unauthenticated responses don’t carry the rate-limit headers, so the budget is genuinely undiscoverable until you have a working key and can read them off a live response. Treat any specific number you see quoted elsewhere as unsourced.
What you can do with it
Documented objects are User, UserProfile, Image, Upload, Node, Album, AlbumImage, and Folder. You can create albums and nodes, and PATCH and DELETE are supported.
Uploads have their own shape: POST to the separate uploader host with a base64 Content-MD5, Content-Length, Content-Type, and X-Smug-AlbumUri and X-Smug-Title headers.
On commerce — orders, pricing, coupons — the honest answer is that nothing appears in the public reference, but that isn’t the same as it not existing. SmugMug’s docs explicitly disclaim completeness: “we have not yet perfected the self-documenting approach, so here we are providing some hand-written explanation about the most critical endpoints.” The full surface is only visible in the logged-in Live API Browser. So budget discovery time rather than assuming either way.
No webhooks, and no Zapier either
There are no webhooks, events, callbacks, or subscriptions anywhere in SmugMug’s API. The only “callback URL” in its vocabulary is the OAuth 1.0a redirect, which isn’t an event mechanism.
SmugMug also has no Zapier app — the listing returns a 404, while Flickr’s and Dropbox’s return 200, so that’s genuine absence rather than a blocked check.
The consequence is simple and unavoidable: anything that needs to react to a new photo, a new album, or a new order has to poll for it.
That leads to the trap worth flagging most. SmugMug has owned Flickr since 2018, and the two run entirely separate APIs, keys, docs, and auth. Nothing on SmugMug’s API docs mentions Flickr. But Zapier lists Flickr and not SmugMug — so searching for “SmugMug automation” surfaces Flickr tooling that will never touch a SmugMug account. Both platforms even use OAuth 1.0a, which makes the tutorials look interchangeable when they absolutely aren’t.
Is it still maintained?
Fairly characterized: stable and supported, but not evolving.
The API responds correctly today, and removing v1.3.0 in 2025 was real lifecycle work. But the docs index still reads “The SmugMug API v2 is here!” — launch-era copy for something that shipped around 2013. The official smugmug-api-docs GitHub organization holds two repos, last pushed in 2015 and 2014. There’s no changelog and no release notes.
Nothing here suggests the API is going away. It does suggest you shouldn’t expect webhooks to arrive.
Two things that will cost you an afternoon
- Auth is checked before routing.
/api/v2/garbagepath12345returns401 Unauthorized— identical to a real endpoint called without credentials. You cannot distinguish “this endpoint doesn’t exist” from “I’m not authenticated,” which makes typo debugging and endpoint discovery genuinely painful until you have a valid key. - The uploader rejects standard OAuth library defaults. Per the docs: “The Uploader only supports receiving the OAuth parameters in the Authorization header, not in the query string or request body.” Most OAuth 1.0a clients default to query-string parameters, so your regular API calls succeed while every upload fails.
Working around the missing events
No webhooks means the only way to know something happened in SmugMug is to ask, repeatedly. For a photographer that’s a real gap: a client gallery gets new activity, an order comes in, and nothing anywhere knows until someone checks.
Reaching for an AI assistant to close it doesn’t work either.
ChatGPT Scheduled Tasks and Claude Cowork both run unattended on timers. Their ordinary task schedulers do not subscribe directly to arbitrary events in connected business apps. ChatGPT Workspace Agents can be invoked through an API, but an upstream system must still detect the event and call it.
So even a scheduled assistant doesn’t solve the SmugMug case cleanly — you need something that polls on a sensible interval, remembers what it already saw, and acts on the difference.
That’s the shape Carly fits:
- Polls on a schedule and acts on what changed — which is the only honest architecture when the platform ships no events
- Runs the whole follow-up in one flow — spot the new gallery activity, draft the client email, send it, log it
- Actually sends — Gmail and Outlook, with attachments
- Reacts to events elsewhere in the chain — your inbox, your calendar, your CRM do fire events even when SmugMug doesn’t, and those are often the better trigger anyway
With a SmugMug subscriber API key, you can connect it natively to Carly from the Integrations tab. Carly handles the OAuth 1.0a connection and can use SmugMug in on-demand, recurring, and event-triggered workflows. AI agents start at $35/month, and workflow steps that don’t use AI run free.
Frequently Asked Questions
Which SmugMug plans include API access?
All of them. SmugMug’s docs state the API is available to all current subscribers, with no Pro or Portfolio tier requirement. The only requirement is an active paid account.
Does SmugMug support OAuth 2.0?
No. SmugMug supports OAuth 1.0a only, signed with HMAC-SHA1 or PLAINTEXT over HTTPS. There’s no bearer token or personal access token path. Public data can be read with just an API key in the query string.
Does SmugMug have webhooks?
No. There are no webhooks, events, or callbacks in the API, and no Zapier app either. Anything that needs to react to changes in SmugMug has to poll.
What is the SmugMug API rate limit?
SmugMug documents the mechanism — windowed limits with X-RateLimit-Remaining and X-RateLimit-Reset headers and a 429 on breach — but publishes no numbers. You can only read your budget from live authenticated responses.
Is the SmugMug API the same as the Flickr API?
No, despite SmugMug owning Flickr since 2018. They’re separate APIs with separate keys, docs, and registration. Zapier lists Flickr but not SmugMug, so Flickr tooling found via search will not work with a SmugMug account.
More: Best AI tools for photographers · Best AI workflow automation tools · Best AI agents for productivity
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
